You can do all that (except in a way that allows you to verify your vote was counted without being able to prove it to others) without a digital electronic voting system.
All you need is the ordinary "fill in the bubbles" optical scan system with two changes:
1. Special ink is used to print the ballots,
2. A special marker is used to mark them.
See "Scantegrity II: End-to-End Verifiability for Optical Scan Election Systems
using Invisible Ink Confirmation Codes" [1] (in HTML [2]) and "Proving Coercion-Resistance of Scantegrity II" [3].
The problem with electoral systems is that one of the key threat actors you need to protect against from are the people running the election. And so any sort of a "special" requirement goes out the window, because it's not really special when you have arbitrary access to it.
This is why public/transparent systems can be so powerful. They are literally impossible to cheat, even if a bad actor has complete unmoderated read/write access to every single system.
All you need is the ordinary "fill in the bubbles" optical scan system with two changes:
1. Special ink is used to print the ballots,
2. A special marker is used to mark them.
See "Scantegrity II: End-to-End Verifiability for Optical Scan Election Systems using Invisible Ink Confirmation Codes" [1] (in HTML [2]) and "Proving Coercion-Resistance of Scantegrity II" [3].
[1] https://www.usenix.org/legacy/event/evt08/tech/full_papers/c...
[2] https://www.usenix.org/legacy/event/evt08/tech/full_papers/c...
[3] https://eprint.iacr.org/2010/502.pdf